Could not add identity "id_ecdsa_sk": agent refused operation
limpkin opened this issue · 13 comments
Hello and thanks for the amazing project!
I'm encountering a few issues trying to setup password-less authentication with your tool on one of my servers.
In short, I'm doing the following: https://github.com/mooltipass/minible/blob/gh-pages/fido2_openssh_from_windows.md
However, ssh-add -S winhello.dll id_ecdsa_sk fails while ssh-add id_ecdsa_sk succeeds ....
Ok, I think you(or the guys who wrote the guide) forgot a step:
From the ssh-agent man page:
-P allowed_providers
Specify a pattern-list of acceptable paths for PKCS#11 provider and FIDO authenticator middleware shared libraries that may be used with the -S or -s options to ssh-add(1). Libraries that do not match the pattern list will be refused. See PATTERNS in ssh_config(5) for a description of pattern-list syntax. The default list is “/usr/lib/,/usr/local/lib/”.
As I've tested, if you do not provide an absolute path to winhello.dll, agent refuses the connection, so you should do one of these:
- Start
ssh-agentlike this:ssh-agent -P /usr/bin/winhello.dlland add the key like this:ssh-add -S /usr/bin/winhello.dll - Copy the
winhello.dllfile into lib folder, start agent normally(since it's default path include lib dir) and add the key like this:ssh-add -S /usr/lib/winhello.dll
You can also add export SSH_SK_PROVIDER=/usr/bin/winhello.dll(full path) to ~/.bashrc to stop writing -S parameter every time.
I'll update the readme file to mention this. Please try this and report back to me, thanks.
will do, thanks a lot :)
that did the trick!
A few additional questions: I'm getting a "init_winhello: WARNING! This should not be like this!"
Also, when creating the new user, what's the parameter to specify the user?
A few additional questions: I'm getting a "init_winhello: WARNING! This should not be like this!"
This is related to Microsoft, nothing to do atm, you do not need to worry about it.
Also, when creating the new user, what's the parameter to specify the user?
ssh-keygen -t ecdsa-sk -O user=newuser
ssh-keygen -t ecdsa-sk -O user=newuser
Hmm that's interesting.... it seems that in this case the user_handle changes yet the user_name remains the same (ssh user). Is that intended? I was expecting the username to change as well :)
edit: just issued a PR :)
You are right, I think my test for this part was wrong, will correct it ASAP.
thanks a lot :)
(hopefully) last question: have you tested interoperability with Linux? Namely, using a Ubuntu client, will it try to access the "ssh" service name?
I'm not sure what you mean. This module only works in Windows how should I test it with Linux client?
I've tested connecting to Linux server and it was ok.
I mean: the credentials stored inside the U2F token, can they be used on another OS, importing the same "private" key file?
Ah yes, the result of this module is exactly same as result without it, I tested this part.
this is awesome, thanks!